CCNA Network Services and Security Practice Test 35 — 15 Questions

Question 1

Which four of the following are best practices for securing network services and devices? (Choose four.)

Accepted Answer

Disable unused ports and services on routers and switches.. Disabling unused ports, implementing role-based access control (RBAC), enabling logging, and keeping firmware updated are all critical security best practices: they reduce the attack surface, limit user permissions, detect threats, and patch known vulnerabilities. Using Telnet is insecure because it transmits data in cleartext, unlike SSH. Placing all devices on the same VLAN undermines network segmentation and allows lateral movement by attackers.

Answer

Place all network devices on the same VLAN to simplify security policy enforcement.

Answer

Use Telnet for remote management because it is simpler to configure than SSH.

Question 2

A network administrator is troubleshooting an issue where hosts in the 192.168.20.0/24 subnet cannot reach the Internet, while hosts in 192.168.10.0/24 can. The router is configured for PAT overload using a dynamic pool on the outside interface. The administrator collects the configuration shown in the exhibit. What is the most likely cause of the connectivity problem for the 192.168.20.0/24 subnet?

Accepted Answer

The wildcard mask in access list 20 is incorrect; it matches only the network address.. The issue is that access list 20, used to define which internal addresses are eligible for NAT, has a wildcard mask of 0.0.0.0. This wildcard mask matches only the exact address 192.168.20.0, not the entire 192.168.20.0/24 subnet. For a /24 subnet, the correct wildcard mask should be 0.0.0.255, which would match all addresses from 192.168.20.1 to 192.168.20.254. Because the ACL matches only the network address (192.168.20.0), no host traffic from that subnet is translated, breaking Internet connectivity.

Answer

The NAT pool does not have enough IP addresses to support both subnets.

Answer

Interface GigabitEthernet0/2 is missing the ip nat inside command.

Answer

Access list 10 is incorrectly applied to the NAT pool, causing a conflict.

Question 3

Drag and drop the following steps into the correct order to configure and apply an extended IPv4 ACL on a Cisco router to block Telnet traffic from subnet 192.168.1.0/24 to host 10.0.0.1 and permit all other IP traffic.

Accepted Answer

Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.. Correct order: 1) Identify the traffic to filter and the interface/direction because this planning determines all subsequent configuration choices. 2) Enter global configuration mode to access ACL definition. 3) Configure the deny statement first — ACLs are processed top-down, so the specific deny must precede the general permit to actually block the unwanted traffic. 4) Add the permit statement after the deny to allow everything else. 5) Enter interface configuration mode to attach the ACL to a specific port. 6) Apply the ACL with the correct direction (inbound) using the ip access-group command, which activates the filtering. 7) Verify the ACL is correctly applied to confirm the configuration is functioning as intended.

Question 4

Drag and drop the following steps into the correct order to configure NTP with authentication on a Cisco router.

Accepted Answer

Define an NTP authentication key using the ntp authentication-key command.. First, define the NTP authentication key using the ntp authentication-key command to create the key that will be used. Second, enable NTP authentication globally with ntp authenticate so that the router requires keys for NTP associations. Third, specify which keys are trusted with ntp trusted-key so the router accepts those keys. Fourth, associate the NTP server with the key using the ntp server command with the key option, linking the server to the trusted key. Finally, verify the authenticated association using show ntp associations to confirm the configuration is working. This order is required because the key must exist before it can be trusted, authentication must be enabled before keys are checked, and the server must be configured with the key only after it is trusted.

Question 5

Drag and drop the following steps into the correct order to implement DHCP services for clients in VLAN 10 using a centralized DHCP server in VLAN 20 and to protect the network with DHCP snooping.

Accepted Answer

Configure the DHCP server with an IP address pool for the 192.168.10.0/24 subnet and ensure connectivity to VLAN 20.. The correct order requires the DHCP server to be configured first so it can respond to requests. Then the IP helper-address is configured on the default gateway interface for VLAN 10 to forward client broadcasts to the server. Next, DHCP snooping is enabled globally, followed by identifying the trusted port to the server (to allow DHCP replies), and then snooping is enabled on the client VLAN. Finally, a client connection triggers a DHCP transaction that you can verify with the snooping binding table.

Question 6

Drag and drop the following steps into the correct order to configure a secure Cisco switch, from enabling secure management access to implementing advanced dynamic ARP inspection.

Accepted Answer

Configure the switch hostname and IP domain name.. 1. Hostname and IP domain name: required to generate RSA keys for SSH in the next step. 2. RSA key generation: SSH cannot function without cryptographic keys. 3. SSH v2 enabled and Telnet disabled: ensures secure remote access before any authentication method is applied. 4. AAA authentication with RADIUS/TACACS+ on vty lines: controls who can access the switch after SSH transport is established. 5. Port security on access ports: protects the data plane by restricting MAC addresses once management plane is secured. 6. DHCP snooping: builds a binding database used to validate traffic; must be active before DAI can work. 7. Dynamic ARP Inspection: relies on the DHCP snooping database to filter ARP packets and prevent man-in-the-middle attacks, so it must be configured last.

Question 7

Drag and drop the following steps into the correct order to configure a Layer 3 switch to perform DHCP relay agent and DHCP snooping for a remote DHCP server.

Accepted Answer

On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.. Correct order: 1) Create DHCP pool on the server to have valid lease parameters; 2) Assign IP address to the SVI so it can act as the gateway and relay agent for the subnet; 3) Globally enable DHCP snooping to activate the feature; 4) Enable snooping on the client VLAN so that only that VLAN’s DHCP traffic is filtered; 5) Set the interface facing the server as trusted to allow DHCP replies; 6) Configure ip helper-address on the SVI to forward client DHCP broadcasts to the server. Each step depends on the previous: the server must be ready; the SVI needs an IP before the helper can be applied; snooping must be globally on before per-VLAN settings; trusted port must be defined before relayed replies are accepted; finally, the helper address enables the actual relay.

Question 8

Which TWO statements accurately describe Network Address Translation (NAT) types?

Accepted Answer

Static NAT creates a fixed one-to-one mapping between a local and global address and is typically used to allow external connectivity to internal servers.. Static NAT creates a permanent, one-to-one mapping between an inside local (private) IP address and an inside global (public) IP address. This fixed mapping is typically used to make internal servers, such as a web or email server, reachable from the internet using a consistent public address.

Answer

PAT only translates TCP packets because it uses port numbers, leaving UDP translation unsupported.

Answer

Static NAT entries are automatically removed after periods of inactivity to free up public addresses.

Answer

With PAT, if the public IP address pool is exhausted, new translations fail because PAT requires unique public IPs for each private host.

Question 9

Which TWO statements about IPv4 and IPv6 ACLs are true?

Accepted Answer

Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.. Extended IPv4 ACLs filter on source and destination IP addresses, ports, and protocols, so placing them as close to the source as possible prevents unwanted traffic from traversing the network, reducing bandwidth waste and security risks. This is a best practice for extended ACLs, unlike standard ACLs which should be placed close to the destination.

Answer

Standard IPv4 ACLs use numbers in the range 100-199.

Answer

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Answer

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Question 10

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

Accepted Answer

The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.. DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Answer

The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

Answer

DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

Answer

The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

Question 11

A network administrator notices that syslog messages from a core router are arriving at the syslog server with timestamps that are hours behind other devices. The router’s NetFlow exports also show incorrect start and end times for flows, making traffic analysis unreliable. The administrator verifies that all router interfaces are up and that the SNMP community strings on the router match the NMS.

Accepted Answer

The router’s NTP client is configured with an incorrect authentication key.. The router's timestamps are incorrect for both syslog messages and NetFlow exports, which points to a system-wide time synchronization issue. NTP (Network Time Protocol) is responsible for maintaining accurate time on network devices, and if the NTP client is configured with an incorrect authentication key, it will fail to synchronize with the NTP server, causing the router's clock to drift. This explains why all time-stamped data (syslog and NetFlow) is consistently behind.

Answer

The logging trap level is set to informational, so only high-severity messages are sent with correct timestamps.

Answer

The SNMP v3 user’s privacy password is incorrect, causing the NMS to reject syslog traps.

Answer

The IP flow cache timeout is set too low, causing NetFlow timestamps to appear skewed.

Question 12

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

Accepted Answer

The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.. The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database. DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Answer

The SSH ACL is misconfigured and denies port 22 from the management subnet.

Answer

Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

Answer

RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

Question 13

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

Accepted Answer

The switch port connecting to the router is not configured as a trusted port for DHCP snooping.. DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Answer

The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

Answer

The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

Answer

DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

Question 14

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Accepted Answer

Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.. First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.

Question 15

Which TWO actions does DHCP snooping perform by default on a Cisco switch?

Accepted Answer

It blocks DHCP server messages received on untrusted ports.. DHCP snooping is a security feature that, by default, filters DHCP server messages (such as DHCPOFFER, DHCPACK, and DHCPNAK) received on untrusted ports. This prevents rogue DHCP servers from offering malicious IP configurations to clients. The switch also automatically builds and maintains a DHCP snooping binding table, which maps client MAC addresses to leased IP addresses, VLANs, and port information, to validate DHCP traffic.

Answer

It generates a Cisco Discovery Protocol packet for each DHCP request.

Answer

It relays DHCP requests across VLANs.

Answer

It converts DHCP broadcasts into unicasts.